BYOVD (Vulnerable Driver) × Microsoft Defender

The technique bypasses EDR hooks, PPL, and monitoring by operating on a copy, leveraging BYOVD to disable PPL in kernel memory.

Doppelganger clones the LSASS process using NtCreateProcessEx after disabling PPL via a signed vulnerable driver (RTCore64.sys) that writes to the EPROCESS structure in kernel memory. It resolves APIs dynamically from clean DLLs to avoid IAT scanning, steals a SYSTEM token from winlogon.exe for privileges, and then dumps credentials from the clone, which lacks EDR hooks and PPL.

Monitor for loading of known vulnerable drivers like RTCore64.sys via service creation (Event ID 7045) or driver load events. Detect attempts to access winlogon.exe for token theft and use of NtCreateProcessEx with LSASS as a parent. Blocklist vulnerable drivers and enforce PPL with LSA protection.